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ABSTRACT 


Automatic flight control systems provide means for significantly enhancing 
survivability in severe wind hazards. The technology required to produce the 
necessary control algorithms is available and has been made technically feasible 
by the advent of digital flight control systems and accurate, low-noise sensors, 
especially strap-down inertial sensors. The application of this technology and 
these means has not generally been enabled except for automatic landing systems, 
and even then the potential has not been fully exploitea. To fully exploit the 
potential of automatic systems for enhancing safety in wind hazards requires 
providing incentives, creating demand, inspiring competition, education, and 
eliminating prejudicial disincentives to overcome the economic penalties asso- 
ciated with the extensive and risky development and certification of these sys- 
tems. If these changes will come about at all, it will likely be through changes 
in the regulations provided by the certifying agencies. 

INTRODUCTION 

The task of improving aircraft safety for the low-level wind hazard takes 
two forms: 

1) Detection and avoidance; 

2) Enhanced survivability. 

The approaches emphasized for survivability have been: 

• Pilot training and procedures; 

• Airframe/engine capability; 

• Displays and annunciations. 

Another approach that currently receives less emphasis than the others, but 
which offers greater potential, is the use of automatic systems, both coupled 
systems, which control aircraft motion unassisted, and director systems, to pro- 
vide commands which the pilot controls. 

Simulations of low-level shear hazards that have been associated with major 
incidents have confirmed the marginal ability or inability of pilots to cope with 
the hazard. Yet, the same simulations are used to demonstrate the high capability 
of automatic systems not only to survive the hazard, but to maintain precision 
tracking. Too often, major incidents occur after the pilot has turned off his 
automatic system, either by choice or by requirement. 

Automatic systems have the ability to receive and quickly process large 
amounts of data simultaneously, and, thereby provide much quicker detection 
and reaction to a wind hazard than a pilot. The time to detect and react is 
frequently more important than the magnitude of the control applied. The longer 
the detection/reaction time, the greater the magnitude of the control required. 
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On the other hand, the pilot frequently has advantages of: 

• Greater control authority and rate capability; 

• Flexibility and adaptability; 

• Less susceptibility to hazardous reaction to failures; 

• Access to more controls, particularly secondary controls. 

The advantages the pilot has over automatic systems are generally not 
inherent; the technology required to reduce or eliminate these advantages is 
available. Enabling the application of, or creating the demand for, this 
technology is the challenge. 

In the following, the available technology and other potential means and 
needs for enhancing the capability of automatic systems to cope with wind hazards 
are discussed qualitatively. 

CONTROL ALGORITHMS 
“ ■ ' » 

At one time, the unavailability of quality sensors and computational capa- 
bility for a reasonable amount of analog hardware restricted control algorithms 
to little more than a raw error signal operated on by a proportional gain, 
integral control and gain, and perhaps a rate damping term. A few gains dictated 
all aspects of automatic control; stability, tracking performance, activity in 
response to sensor noise and disturbances, and response to commands. Development 
of the control algorithms was more an exercise of seeking the best compromise. 
Sometimes filtering was added to reduce the effect of high-frequency activity 
from noise and disturbances, thereby permitting higher gains, but. the tracking 
performance from the higher gains was largely offset by the adverse effect fil- 
tering had on stability and performance. Any increase in performance had an 
attendant increase in disconcerting activity and a tendency towards limit cycling 
due to rate saturation. The most important feature of the automatic mode, 
particularly speed control modes (by elevator or throttle) operating in a changing 
wind environment, may well have been the disconnect buttons or, at least, those 
buttons that revert to pitch and roll altitude command modes and allow the 
pilots to be the outer loop algorithms. Not only was there a hesitancy to seek 
higher levels of tracking performance for the variable wind environment (a fruitless 
exercise since the pilot would disengage the system due to the high level of 
attendant non-productive activity), there were overt attempts to degrade perfor- 
mance for the more severe wind environment so that the non-productive activity 
would remain within acceptable bounds (the "TURB" button). 

The introduction of the digital computer has provided a tremendous computa- 
tional capability. Combined with the new generation of high-accuracy, low-noise 
digital sensors, especially strap-down inertial sensors, a new architecture for 
control algorithms has been enabled,. 

• The former error signals can be split into the target and feedback 
components, which are processed separately before combining to 
form new error signals. 

• The targets can be processed linearly and non-linearly to shape and 
control target acquisition without affecting stability and response 
to noise and disturbances. 
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t The feedback signals can be blended with inertial data to provide 
a signal having the static accuracy of the raw feedback signal and 
the low-noise, high-dynamic accuracy of the inertial signal without 
significant effects on stability and tracking performance. This 
blending can include the removal of sensor location effects resulting 
from coupling with angular motion. 

• Comparison of air data and inertial data can be performed to derive 
wind components and their derivatives which can then be processed 
linearly and non-linearly before re-introduction into the feedback 
signal. This allows a high degree of independence between response 
to shear, response to turbulence, still air tracking performance, 
and stability. 

• The derived wind components can be used for predictive control 
corrections that are applied as the wind disturbance occurs, but 
before feedback signal disturbances, thereby preventing the signal 
disturbances. 

• The derived wind signals can be used predictively to remove the 
deterministic "noisy" responses of inertial signals to turbulence. 

The result of applying these and other techniques is a much higher level of 
tracking performance for the previous level of unproductive activity. The feed- 
back gains for attitude and path control functions can now be increased to the 
stability limits with virtually no increase in activity due to turbulence and no 
adverse effect on target capture performance. 

For modes that control airplane motion relative to the air mass, principally 
airspeed modes, the trade-off between performance activity remains, though weaker 
and with much better performance for the same activity. This is principally due 
to the still imperfect inability to distinguish between the wind speed changes 
that will continue (shear?) and those that abruptly change (turbulence?). 

The development of these modern control algorithms to maximize tracking 
performances in winds with acceptable activity and good maneuvering characteris- 
tics, required to gain the pilots trust and acceptance, does not come cheaply, 
quickly, nor without high technical risks. They, therefore, tend to be applied 
for terminal area modes only where required, specifically for Category III auto- 
matic landing, where the regulations on touchdown dispersions and airspeed control 
in winds are very stringent. 

The availability of Category III automatic landing systems is limited prin- 
cipally to commercial transports. They are not used extensively for long-range 
aircraft due to the need for the pilot and co-pilot to perform a minimum number 
of manual landings each month to maintain their proficiency and to the limited 
number of landings available. 

Category I and II automatic approach systems do not require tracking as tight 
nor do they require autothrottles. Hence, the survivability they provide in severe 
winds is not as good. 
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When coupled go-around modes are provided, they frequently do not provide 
closed-loop speed and path control, but only assure positive acceleration and 
vertical speed for a range of weights and thrust in still air. Go-around flight 
director modes may consist of nothing more than a fixed-pitch attitude command. 

Coupled takeoff modes are not provided at all, even though an airplane 
fully equipped for a Category III-B automatic landing is also equipped to per- 
form a "Category III-B automatic takeoff", if regulations existed to cover such 
a mode. One argument against such a mode is the lack of airports equipped with 
localizer deviation or the equivalent to enable steering down the runway for 
takeoffs. A similar argument was used against Category III-B automatic landings. 
Coincidently , when the latest commercial aircraft were being developed with 
Category III-B automatic landing capability as standard equipment, there was an 
explosion in the number of Category III-B certified airports in the U.S. 

Like the go-around function, the automatic takeoff pitch control function 
is essentially a speed control task. By controling speed, thrust in excess of 
that required for level flight is converted to vertical speed. Complexity may 
be added to prevent selecting too low a speed (by estimating the equivalent of 
a minimum speed using angle of attack, inertial data, and configuration sensors) 
and to force a thrust deficiency to cause a speed reduction rather than a loss 
of altitude. Additional complexity is needed for the takeoff flight director 
to accommodate the pilot's rotation without over-shooting the attitude required 
for stabilized speed. 

By employing airspeed and vertical speed blended with inertial data and 
inertial acceleration, speed control through pitch control can counteract the 
effects of variable winds. However, many takeoff flight directors provide 
nothing more than a fixed-pitch attitude command for all conditions. Even 
proposed advanced concepts plan to pre-compute a fixed-pitch attitude command 
based on pilot-entered weight, expected thrust, configuration, and ambient 
pressure and temperature. This attitude command would then result in the 
correct climb-out airspeed when controlled, but only in still air. 

Takeoff autothrottles rapidly advance thrust to a selected setting, then 
disengage during the ground run at a predetermined airspeed so as to protect 
against a failure that could cause a thrust reduction. Whenever excess field 
length exists for the available thrust, the choice is invariably made to reduce 
the thrust setting so as to save engine life rather than to use all the thrust 
to accelerate to a higher rotation and climb-out in order to increase climb 
capability and speed margins. With the autothrottle inhibited from engagement, 
it does not attempt to detect an energy deficiency, as may occur in variable 
winds, and then advance thrust to the maximum available. 

CONTROL AUTHORITY AND FAILURE PROTECTION 


The classic method of preventing a failure that could cause an automatic 
system to command so much control surface so as to cause structural failure or 
a dangerous maneuver is to limit the control surface that can be commanded to 
a "safe" maneuver level. This limiting is achieved by servo displacement limits 
or by limiting the force or torque the servo can produce against the force or 
torque from the surface hinge moments or the control feel unit. The problem 
with this technique is that it also limits the control authority available to a 
non-failed system to counteract the effects of severe disturbances. 
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The "fail-safe" maneuver becomes excessive for operation near the ground, 
yet the control authority required at low speeds, even in still air, may easily 
exceed the fail-safe limits. Hence, for a Category III automatic landing system, 
two or more systems, each with their own servos, are used with their limited 
authorities summed to increase control authority when the multiple systems work 
together. When one system fails, the good systems counteract the failed system's 
command. 

The control authority available from simultaneous multiple automatic systems 
is seldom provided for other than automatic landing systems and even then may 
not match the capability of the pilot. An aircraft equipped with a Category III 
automatic landing system is equipped to provide multiple system operation for all 
flight phases; therefore, it enhances survivability in severe winds. The addi- 
tional expense is associated with much more testing and is substantial. 

Most aircraft, especially smaller aircraft, are not equipped for Category 
III automatic landings because of the high cost, weight, and power consumption 
of the redundant equipment. 

Digital computers have enabled an alternative approach — the self-monitored 
system. The processing capability is used to analytically detect failures in 
sensors, servos, and within the processor itself. This approach can eliminate 
the need for multiple servos for fail passivity and authority limiting fail safety, 
but the development and testing of the monitors required is very extensive and 
expensive. 

The monitoring approach can also be used to raise low rate limits applied 
to protect against oscillatory failure and flutter coupling. These low- rate 
limits not only prevent the control command from keeping up with the disturbance, 
but, when saturated, can also cause a biased target or unstable limit cycling. 

Pitch control authority can be further enhanced by quickening the trim 
response to trim command and increasing trim rate. Trim motion is typically 
delayed in response to a trim command all the time in order to prevent the trim 
from increasing the maneuver response to a hardover failure before a pilot 
reacts to the fault. Failure monitoring can eliminate the requirement for the 
delay. The trim rate available to the automatic system is typically half or 
less than that available to the pilot, although there is no failure requirement 
to force this disparity. 

The subject of authority also includes lift. Some automatic functions are 
designed to prevent the attainment of additional lift near stall that might 
otherwise be used to prevent loss of altitude in a severe wind hazard. Systems 
that are allowed to operate near stall must be disconnected upon , the onset of 
stall in order to prevent the natural automatic control reaction that is opposite 
to that required for stall recovery. To enable the additional lift near stall 
to be available, a very high accuracy and performance control algorithm is re- 
quired to prevent stall, yet not interfere with very near-stall lift attainment. 

INCENTI VE/DISINCENTI VE 


The major challenge of enhancing safety for wind hazard, no matter what the 
means, is enabling the application of technology. This is a matter of creating 
incentives, eliminating disincentives, or creating disincentives for not 
enhancing safety. Sources of these incentive/disincentives are interrelated and 
include: 
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• Regulations 

• Competition 

• Economics 

• Education 

For the most part, regulations address disincentive. They don't say how a 
characteristic must be achieved, although FAA advisory circulars tend to promote 
methodologies by describing acceptable approaches, but describe what minimum 
characteristics an aircraft must have before it can be sold and what requirements 
optional functions must have. Regulations principally address safety and truth 
of advertising (satisfaction of intended function). 

There's little doubt that the regulations governing automatic landing systems 
are responsible for the relatively high levels of performance of these systems in 
variable winds, although the homogeneous boundary-layer wind and turbulence models 
suggested may be lacking in accuracy and severity. Perhaps more important than 
updating these models is the application of similar treatment to other terminal 
area automatic modes. 

Except for the automatic landing system, there is no quantitative minimum 
requirement for wind hazard survivability. Wind and turbulence models for auto- 
matic landing system simulation are analytic and parameterized. Minimum require- 
ments are specified in terms of tower wind component levels and variation of 
horizontal wind with altitude. Minimum requirements are low and aircraft manu- 
facturers usually seek certification to higher wind levels to enable automatic 
landings for more conditions. The test, however, is against the objective cer- 
tification level. Seldom are efforts made to determine the maximum level of 
wind hazard the system is capable of surviving. There are no requirements for 
simulation demonstration of survi vability in the severe non-homogeneous wind 
disturbances such as microbursts and storm fronts, although aircraft manufacturers 
do test these systems in simulations of these severe hazards. 

An obvious question arises: Should regulations require minimum wind hazard 

flight control survivability, at least for terminal area operation? Requirements 
do exist for structural survivability. Such requirements would involve specifi- 
cation of the wind hazard model and a means for measuring success. The require- 
ment should not specifically address automatic systems, rather automatic systems 
would be one of several means for showing compliance. Capability in excess of 
the minimum requirements could be rated; then this rating, similar to the auto- 
mobile's estimated miles per gallon, could be a means for spurring competition 
and increasing awareness. 

Part of the incentive for providing automatic systems is lost because 
regulations have two standards for manually and automatically controlled flight, 
and because they do not give credit for the superior performance of the automatic 
system. For example, although an automatic landing system may clearly demonstrate 
greater survivability in a wind shear hazard than manual flying, that same auto- 
matic system will likely be certified to conduct automatic landings in wind con- 
ditions less severe than is the pilot. This is because manual landing capability 
and performance are not based on the same strict standards that apply to automatic 
landing systems. Additionally, though approach airspeeds are not increased for 
increased wind severity for automatic landing systems as they normally are for 
manual flying, and though an automatic system may demonstrate much less likelihood 
of touching down long than a pilot, the field length requirements are the same for 
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both. Field length requirements don't even reflect the tendency for manual 
landings to touch down at higher speeds for more severe winds. 

New automatic systems tend to be introduced only at the same time as new 
aircraft with a short development cycle, although additional features may be 
added to an existing aircraft. This is the worst possible time to aggressively 
seek the large potential benefits that entail technical and program risks. 

There is great pressure to reduce goals and assure that a system with lesser capa- 
bility works well; the superior characteristics of an automatic system will not 
likely sell airplanes, but the inferior characteristics might prevent airplanes 
from being sold. A high-performance automatic system requires good detail 
models of aerodynamics, the control system, and sensors. New program pressures 
and the concurrent development of the airplane configuration, control system, 
and sensors prohibit that detailed modeling. 

The best time to develop or, at least, evolve a high-performance automatic 
system is after an airplane is in production. If the evolution takes place, 
there is less need to make large technological advances during the development 
of the next new airplane. 

The difficulty is convincing the customer he needs a new automatic system 
when his present one is performing adequately, particularly if the purpose is 
to enhance safety for what is perceived as an extremely remote event. 

There is also a major role for education to play in eliminating disincentive. 
The pilot must be convinced that the severe wind hazard he could not cope with 
on the simulator is real, not an artificial contrivance, even though he never 
has and likely never will experience a similar hazard in flight. The pilots 
and airline passengers must be educated that attitude changes and engine modu- 
lations are indicative of tight control necessary to insure safety in the event 
that the change in wind experienced persists or subsequently changes more 
violently. 

QUESTION : 

Do you think that a realistic goal would be certification requirements 

for the design of the airplane and systems that are compatible with the 

airplane's performance? 

RESPONSE : 

I think the certification requirements of the automatic system are quite 
precise, and that is probably more of a standard, although it's a very exhaustive 
and expensive certification to go through. I guess what I was implying is that 
they talk about the airplane's capability, but when they measure the airplane's 
capability, it is actually an airplane/pilot capability. If you force the air- 
plane pilot to go through the same kind of standards, then you probably would see 

a disparity and would come up with different conclusions as to what the capa- 

bilities were. 

QUESTION : 

Could the logic of the system be designed such that it will extract the 
maximum performance of the airplane through a given encounter? 
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RESPONSE: 


Unfortunately, there are two sides to the story. You always pay for 
something that you get, particularly in the performance area, and particularly 
in speed-control modes, which is your principal means for counteracting. That 

is, under benign conditions, you may have more activity. Generally, the higher 

performance you get, the higher the activity, and you will be pressured to 
make sure that you are providing very good characteristics for the still -air 
environment, even if it means sacrificing for the more severe. I say part of 
that is going to come out of aducation, and maybe part of that comes out of 

our regulations. It's going to take somewhat of a change of attitude. 
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